Add pre-built mitmproxy image with 1Password CLI

[adamw]

Summary

• Adds images/mitmproxy/Dockerfile extending mitmproxy/mitmproxy:latest with the 1Password op CLI (multi-arch: amd64 + arm64)
• Adds GitHub Actions workflow to build and publish ghcr.io/virtuslab/sandcat-mitmproxy on pushes to master
• Prerequisite for Allow providing secret values through 1password #38 (1Password secrets integration) — the feature PR (Add 1Password integration for secret resolution #39) will reference this pre-built image

Test plan

• Verify the workflow builds successfully for both architectures
• Verify ghcr.io/virtuslab/sandcat-mitmproxy:latest is published after merge
• Verify op --version works inside the published image

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR introduces a pre-built mitmproxy container image that includes the 1Password op CLI, and adds CI automation to build and publish that image to GHCR. This supports upcoming work for 1Password-backed secret resolution (issue #38 / PR #39) by providing a reusable image artifact.

Changes:

• Add images/mitmproxy/Dockerfile extending mitmproxy/mitmproxy with the 1Password op CLI.
• Add a GitHub Actions workflow to build and publish a multi-arch image (amd64 + arm64) to GHCR on pushes to master.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
images/mitmproxy/Dockerfile	Builds a mitmproxy-based image and installs the op CLI into /usr/local/bin.
.github/workflows/build-mitmproxy-image.yml	Builds/publishes the mitmproxy+op image to GHCR with metadata-based tagging.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The 1Password CLI binary is downloaded and installed without any integrity verification (checksum/signature). This is a supply-chain risk for an image that will be published to GHCR; consider validating the downloaded zip against the official SHA256 (or signature) before unzipping/installing.

Suggested change

	&& unzip /tmp/op.zip -d /usr/local/bin op \
	&& rm /tmp/op.zip \
	&& curl -sSfo /tmp/op.zip.sha256 "https://cache.agilebits.com/dist/1P/op2/pkg/v${OP_CLI_VERSION}/op_linux_${ARCH}_v${OP_CLI_VERSION}.zip.sha256" \
	&& (cd /tmp && sha256sum --check op.zip.sha256) \
	&& unzip /tmp/op.zip -d /usr/local/bin op \
	&& rm /tmp/op.zip /tmp/op.zip.sha256 \

[Copilot]

The PR description/test plan references publishing ghcr.io/virtuslab/sandcat-mitmproxy, but the workflow uses ghcr.io/VirtusLab/sandcat-mitmproxy. Please align the image name/casing so the published image matches the documented pull/run command and avoids any registry/name normalization surprises.

[Copilot]

Using mitmproxy/mitmproxy:latest as the base for a published image makes builds non-deterministic and can cause silent breakage when upstream updates latest. Consider pinning to a specific mitmproxy version tag (or digest) and updating deliberately when needed.

Suggested change

	FROM mitmproxy/mitmproxy:latest
	FROM mitmproxy/mitmproxy:10.3.0